Malicious code in telemetry-axios (npm)

The telemetry-axios package distributed via npm is identified as containing malicious code that compromises the host system completely. Installation or execution of this package grants an attacker full control over the affected computer, potentially exposing all stored secrets and keys. Due to the extent of the compromise, simply uninstalling the package does not guarantee removal of all malicious artifacts or backdoors introduced by the attacker.

Full system compromise on any machine running or having installed the telemetry-axios package. All secrets and keys stored on the compromised system are at risk and should be considered exposed. The attacker may maintain persistent access beyond the presence of the malicious package itself.

Immediately remove the telemetry-axios package from all affected systems. Rotate all secrets and keys that were stored on the compromised machines using a secure, unaffected device. Because the attacker may have persistent access, consider rebuilding or thoroughly cleaning affected systems to ensure complete removal of malicious software.